RVTools malvertising campaign (12-21-2025)
- Description: Malicious Google Search ad for RVTools
- Severity: Medium
- Reporter: Jérôme Segura
- Reported to Google: 12/21/2025
Google Search Ad
Traffic view
Decoy page
IOCs
| Fake page | hxxps[://]vmware-rvtools[.]app |
| Payload URL | hxxps[://]download[.]rvtools[.]store/RVTools_Latest_Stable[.]msi |
| Payload SHA256 | 5154fb9a138e7d156d775f6a9a61bbb114f0b824a467b77bac230ba600276344 |